Spain crypto license 2026 — CNMV CASP authorisation
Spain's CASP licence runs through the CNMV, designated competent authority for MiCA by Law 6/2023. The CNMV is the dedicated supervisor while SEPBLAC handles AML, and new entrants file against the standard Article 63 clock of 40 working days with a real Spanish substance bar on top.
Last reviewed by the Crypto Law Index editorial desk
Why the CNMV is one of the more active EU CASP supervisors
Spain ran one of the largest pre-MiCA crypto-asset service-provider registers in the EU through the Banco de España, driven by retail demand and a busy fintech scene in Madrid and Barcelona. When MiCA took effect on 30 December 2024 and the CASP regime turned on, supervision shifted to the CNMV. The government first notified ESMA of a 12-month transitional period, to 30 December 2025, but that was never written into law, and in December 2025 it notified the full period instead. The CNMV's MiCA FAQ is explicit: in Spain the transitional period ended on 1 July 2026. Earlier versions of this page attributed a 30 December 2025 deadline to a Royal Decree-Law 7/2025; no such crypto provision exists, and the date was wrong.
That conversion pipeline kept the CNMV busy into 2026, and by mid-2026 the steady-state regime is the live pathway — new entrants file fresh CASP applications against the standard statutory clock of 40 working days rather than relying on any legacy register.
The CNMV's substance overlay
MiCA sets the floor for substance — actual presence in the EU, an effective management body, fit-and-proper assessment. The CNMV layers Spanish supervisory practice on top. Advisers describe the working expectations as a senior manager resident in Spain, a real registered office rather than a postal address, and a Spanish-speaking compliance contact able to handle supervisory dialogue. MiCA itself requires only one EU-resident director (Article 59(2)).
These are working expectations reported by advisers rather than bright-line statutory rules. Files that lack them tend to draw an information request, and the AML/CFT framework has to work for SEPBLAC, the AML supervisor. Spain is a poor fit if the goal is the lightest-touch authorisation in the EU — Spanish substance is not free.
The statutory clock starts when the file is complete
MiCA Article 63 gives the CNMV five working days to acknowledge a filing, 25 working days to check it is complete, and 40 working days from a complete file to grant or refuse; one information request can suspend that period for up to 20 working days. The clock does not start until the file is complete, and an incomplete file gets a deadline to fill the gaps rather than a decision. The checklist covers a three-year programme of operations, governance and ICT risk arrangements, the AML/CFT manual and MLRO appointment, the prudential capital position with auditor confirmation, and safeguarding arrangements for client funds and crypto-assets.
The complete-file pre-screen typically takes two to four weeks. Add Spanish translation on the front end and supervisor dialogue on the back, and a realistic end-to-end timeline is six to nine months for a clean first-time application. Once granted, the authorisation carries the EU passport: the CASP can notify the CNMV of cross-border services and begin in the host market once the CNMV confirms it has passed the notification on, or at the latest on the 15th calendar day after notifying (MiCA Article 65(4)).
Spain's CASP authorisation is the licence the Comisión Nacional del Mercado de Valores (CNMV) grants under Articles 59 and 63 of MiCA Regulation (EU) 2023/1114 to crypto-asset service providers established or operating in Spain, granting passporting rights to the other EU and EEA member states on authorisation.
Fast facts
| Parameter | Value |
|---|---|
| Competent authority | Comisión Nacional del Mercado de Valores (CNMV), Madrid |
| Legal basis | MiCA Regulation (EU) 2023/1114 + Law 6/2023 (CNMV designation) |
| AML supervisor | SEPBLAC (Servicio Ejecutivo de la Comisión de Prevención del Blanqueo de Capitales) |
| Initial capital | €50,000 / €125,000 / €150,000 by Class 1 / 2 / 3, MiCA Annex IV |
| Statutory clock | 40 working days from a complete file to decision under MiCA Article 63(9); one information request can suspend it for up to 20 working days |
| Transitional regime | Ended 1 July 2026 (CNMV MiCA FAQ, Q3.1). A 12-month period to 30 December 2025 was notified first but never enacted |
| Application language | Spanish required for the application file; English working translations accepted for cross-border supporting documents |
Top counsel for Spain CASP work
Firms below are ranked according to the published CLPAI methodology. Featured selections cover firms with documented Spain engagement, regardless of where they are headquartered.
Frequently asked questions about Spain CASP authorisation
Who supervises CASP authorisation in Spain?
The CNMV is the national competent authority under MiCA (Law 6/2023). The Banco de España's pre-MiCA register was an AML registration under Ley 10/2010; registered providers could operate during the transitional period, which ended on 1 July 2026. AML supervision sits with SEPBLAC.
Could existing Spanish crypto providers keep operating after MiCA?
They could until 1 July 2026, the end of Spain's transitional period according to the CNMV. That period has closed, so a former Banco de España registrant now needs a CASP authorisation to operate.
Does the CNMV apply Spanish-specific substance requirements?
Not as statutory rules. MiCA requires a registered office in Spain, effective management and one EU-resident director (Article 59(2)). Advisers report the CNMV also expects a Spanish-resident senior manager and a Spanish-speaking compliance contact in practice.
How long does a Spanish CASP authorisation take in practice?
Six to nine months end-to-end for a complete first-time file. The MiCA Article 63 clock of 40 working days starts only when the file is deemed complete, and Spanish-language preparation extends pre-filing time.
Pitfalls and nuances in Spain
1 Treating the Banco de España registration as a head-start
A pre-MiCA Banco de España registration was AML-focused under the 5AMLD transposition and does not confer MiCA authorisation. Providers on the BdE register still had to file a full CASP file — the registration only granted access to the transitional regime, not credit.
2 Filing in English
Although the CNMV reads English fluently and supervisory dialogue can occur in English, the formal application must be filed in Spanish. Articles of association, governance documents, internal policies, and risk assessments need certified Spanish translations — estimate 4-6 weeks for the translation workflow alone on a substantial file.
3 Underestimating SEPBLAC AML expectations
Spain's AML supervisor, SEPBLAC, has historically applied stricter expectations than several other EU jurisdictions — particularly on beneficial-ownership documentation, source-of-wealth files for politically exposed persons, and ongoing customer due-diligence cycles. The CNMV defers to SEPBLAC on AML adequacy.
4 Localised marketing without Spanish-language consumer disclosures
Spain's dedicated crypto-advertising rule, CNMV Circular 1/2022, was repealed with effect from 28 December 2024, when MiCA began to apply; marketing communications now fall under MiCA Article 66, supervised by the CNMV. A good deal of published guidance still cites the old circular as if it were in force. Check the CNMV's current position on language and disclosure before running a Spanish campaign rather than working from that guidance.
Practitioners in Spain
Named lawyers from the Crypto Law Index practitioners directory whose jurisdictional coverage includes Spain. Editorial picks, sourced from public records.
Regulator and primary sources
The supervisor of CASP authorisations in Spain is Comisión Nacional del Mercado de Valores (CNMV). The legal basis is MiCA Regulation (EU) 2023/1114, with the CNMV designated competent authority by Law 6/2023 of 17 March on Securities Markets and Investment Services. Visit www.cnmv.es/portal/MiCA/MiCA.aspx for the regulator's official guidance, application forms, and supervisory expectations.
For where every EU and EEA state stands — its authority, its national act and when its transitional period ended — see the MiCA implementation tracker.